December 2003 - cypherpunks-legacy

Belgium has 'key escrow' law
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

Surprise, surprise. Today's issue of 'De Standaard', Flanders' most respected newspaper, reports that - much to everybody's amazement - Belgium has a key escrow law in working order - or almost... The newspaper states that certain articles of a much 'broader' law that was passed on the 21th of December 1994, if enforced - which to date has _not_ been the case, would imply that encryption of computer messages is illegal unless the private key is registered with the BIPT (the Belgian Institute for Postal services and Telecommunication; a government administration that regulates the telecom sector). At the time of enactment these articles went almost completely unnoticed - hence the amazement. As mentioned, said articles are not enforced yet but it now appears that a working group, called Belinfosec (Belgium Information & Security), led by a colonel of the military intelligence services - no less, is preparing a report which would contain further specifications and would propose enacting clauses. Note that at present there is already legislation up and working that enables Belgian law enforcement to tap telephone lines 'in specific circumstances' (i.e., suspicion of criminal or terroristic activities). Judging by the newspaper article it will not be long before this will include computer messages. Asked for a reaction, officials from the banking sector reacted with both disbelief and outrage. The article quotes the head of security at Banksys (the interbank consortium that operates Belgium's nation-wide ATM/POS-network) who considers it to be "unacceptable" and "an intrusion on privacy" if government authorities were to be able to monitor all the money flows that pass through the Banksys network. He also fears that once revealed to the authorities, the keys might fall into the wrong hands, thus jeopardizing the system's security. I'll try to find out more and keep you informed. Ciao, leo P.S. I'm not on the cpx mailing list, so please Cc me. _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

2 1

Re: When they came for the Jews...
by Adam Shostack 17 Dec '03

17 Dec '03

Sten Drescher wrote: Adam Shostack <adam(a)lighthouse.homeport.org> said: AS> As always, the best answer to bad speech is more speech. Ken McVay, AS> and his Nizkor project, (http://nizkor.almanac.bc.ca) have been AS> involved in fighting hate speech, holocaust revisionism, and the AS> like for long time through archiving the big lies that revisionists AS> pump out, documenting the bogosity of their footnotes, showing their AS> contradictions, etc. Pointing out this, and other net resources AS> fighting anti-semitism is a much cleaner approach than attacking the AS> Wiesenthal center. Isn't this attacking, or at least opposing, them directly? Nope; its changing the terms of the debate. Saying 'you can't make this happen' is attacking them. AS> Someone noted the police stopping skinheads in Oregon-- I'll point AS> out that there is a substantial difference between talking and AS> randomly beating the crap out of people. The later is a fair basis AS> for action by police, although we may choose to question their AS> methodology. There is also a difference between stopping skinheads AS> and stopping blacks, in that the skinheads decided to wear clothing AS> and tattoos that identify them as skinheads, and thus may more AS> fairly be asked to bear the consequences. =09This is known as the "[S]he asked for it" argument, a widely discredited defense. If their _behavior_ doesn't indicate criminal behavior, and there isn't a report of a crime with suspects meeting their descriptions, there is no more excuse for hassling them than there is for hassling blacks, or hispanics, or.... Who knows, they could actually be a bunch of Marines (depending on the area). No, this is not 'she asked for it.' If there are skinheads who fit the description 'bald, black leather, swastikas' attacking people, then stopping people who fit that description is ok by me, as opposed to stopping people who fit the description 'black, medium hight, living in Boston,' which were the criterion here a few years back after Chuck Stewart shot his wife. The lead-in was people being attacked on the street at random. I thought I had hypothosized that they were skinheads. The crypto relevance might be getting thin. I think this will end my contribution to this thread in public. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: David Kahn on C-Span 2
by John Young 17 Dec '03

17 Dec '03

The occasion was a "Cryptologic History Symposium," held on October 26, 1995, at NSA. No time was given for rebroadcast. Kahn spoke briefly on material covered in his book on codebreaking before and during WW2. The second speaker was Professor Colin Burke, Univ. of Maryland, like Kahn a scholar-in-residence at NSA, who reviewed the pre-war and WW2 machines and proto-computers for cryptanalysis. Kahn, a charming speaker, said about Russian cryptanalysis ability during WW2, that while there has been no published material on the period, three talents make for excellent cryptology: chess, music and mathematics, all of which the Russians excell at. --- Other codebreaking news: the English are making a TV-movie on Alan Turing, due to be broadcast around Easter. It is based on the successful theater play a while back.

1 0

Popular Science on US Spysats - Part 1
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, 02 96 Popular Science runs a cover story, America's First Eyes in Space. It's by Stuart Brown. It's about "a secret space reconnaisance program known as Corona." Brown reports that Last year, the federal government declassified the program's history and the more than 800,000 photographs that Corona recorded.... The development of the reconnaisance satellite was "the big- gest advance in the history of the intelligence world," says Jeffrey Richelson, a senior fellow at the National Security Archive. According to the article, the chronology of that and similar pro- grams is: 1955 "Mid-air retrieval of spy cameras was originally de- veloped during the secret Genetrix program authorized by Eisenhower in 1955, which released 516 reconnai- sance balloons to drift across the Soviet Union...." "...the U-2 high-altitude spyplane took to the skies." It made "24 flights...between 1956 and 1960." 1958 "In early 1958, the National Security Council gave the development of photo reconnaisance satellites its high- est priority, and the Corona program was born." 1959 Specifically mentioned is "a failed mission in 1959." Generally mentioned is "the failure of the first dozen missions...." 1960 "In 1960, Corona was placed under the...National Recon- naisance Office." "...on May 1, 1960...[U-2] pilot...Powers was shot down ...." "Eisenhower promised that the United States would cease all manned [!] overflights of Soviet territory." "Just 110 days after the Powers incident, the 14th Cor- ona flight produced photos of...the Soviet Union...." "In mid-August 1960, President...Eisenhower held a press conference to announce the successful recovery of an American flag that had flown into orbit aboard Discover- er XIII. Proudly displaying the flag, Eisenhower told reporters that the Discoverer launch was part of a scientific re- search effort to explore environmental conditions in space. But he was lying." 1962 "Zenit, the first succesful Soviet spysat, was launched in April 1962...." 1972 "Of 145 flights conducted before the [Corona] program's conclusion in 1972,...102 [were] deemed successful...." In 1960, Statesman Eisenhower weazel-worded. Also in 1960 Scientist Eisenhower lied. BIKEL: Impossible! HEPBURN: Nevertheless. --African Queen Cordially, Jim

1 0

Toad Hall
by John Young 17 Dec '03

17 Dec '03

Chapter 2 TOAD HALL In keeping with Internet nomenclature, Toad Hall acquired the Internet domain name toad.com, whose gateway to the rest of the world was a Sun SPARCstation computer in the building's basement. This digital domain was run by John and an eclectic band of programmers and hardware gurus, who together had a diverse political outlook, and while privacy was a priority, computer security at Toad was often pretty loose. ... For the past five years, Toad Hall had been Julia [Menapace]'s home -- for John Gilmore was the "other man," with whom her relationship had been souring even before she and I had met. During the Christmas holidays John was away visiting his relatives in Florida, and so Julia and I had Toad Hall to ourselves when we arrived around 4 P.M. on the afternoon of her flight from Nepal. John, now forty, was someone I'd known from hacker circles, and even as a friend, for a number of years. ... Initially he hadn't minded that Julia and I spent time backpacking together while he worked long hours on his new start-up, because hiking didn't interest him. But once Julia and I had become more intimately involved, things grew chilly between him and me. Julia and I sent out for dinner from an Italian place called Bambino's. When it came, we undressed and sank into the indoor hot tub, eating while we soaked. The upstairs bathroom in Toad Hall is an unusual room. It is faced with a white and pink marble floor and wainscoting surrounding a dark green jacuzzi tub and other fixtures. A large asparagus fern sits on the window ledge, centered above the cascading waterfall of the tub's larger faucet. The fronds of the fern tumble down toward the water. Julia had, put on a cassette tape of Karma Moffet playing Himalayan intruments, and then lit candles; the only other light came from four overhead spotlights that dimly illuminated each corner of the tub. "This is just amazing," Julia murmured through the steamy air. She said she had fantasized continually about a long soak in hot water while trekking in the frigid Himalayas, where water is carried by hand from its source and becomes hot only when heated over flames, and where there is never enough to sit in. And at high altitude in the Solu Khumbu region of Nepal, the only heat had come from the sun, the small cooking fire, and the occasional woodstove fueled by wood scraps or dung. While we ate Julia told me stories of her adventures. In the kitchen of a lodge where she stayed she met and befriended a Sherpa guide named Tshering and a mountain guide from Seattle named Rachel DeSilva, who had led a group of 12 women to climb a 6,000-meter trekking peak in the region named Mara. Afterward they had invited her to climb another mountain named Lobuche, which lay to the north toward Everest. She had made it to just below the summit. I sat entranced. "I wish I had been there too," was all I could find to say. Julia had spent her birthday at the Tengboche monastery to celebrate the Mani Rimdu festival. She showed me a red string necklace that she had received when a Tibetan Lama had blessed her on her thirty-fifth birthday. "Near noon that same day, I heard the sound of long horns, cymbals, and drums," she recalled. "Then an avalanche poured in slow motion down the south face of Ama Dablam." Later in the trip she had stopped at one point to watch a sunset over Everest through the gathering mist, and she said it was so stark and beautiful that she cried. "I thought of you," she told me, "and wished you were there to share it with me." As we soaked, I told her about what had happened to me while she was gone. When Julia left I had been waiting for a $500,000 per year research grant from the National Security Agency, the nation's electronic intelligence- gathering organization. The NSA has two missions: one, its foreign spying mission and the other its responsibility for the security of all the governments computers and communications. In the fall an information security division in the agency had told me they would fund a project permitting me to assemble a team of experts to do research in new areas of computer security. I was ready to go and I had commitments from people to start work, but the agency had dragged its feet for months. Finally I had gotten tired of being jerked around, and two of my researchers had been forced to take other jobs. "I thought everything would be ironed out and I'd come back to find you happily at work with your team," she said. "No it wasn't," I answered. "They're amazingly inept, just like any government bureaucracy." We talked for a while about the NSA and how so many people in the civil liberties community fear them as Big Brother as well as anyone associated with them, arguing that they become corrupted by association. But that had never seemed accurate to me. Everything I'd seen indicated they were a largely incompetent organization tied up in endless regulations that could do little good or evil. And people are quite capable of making up their own minds. "I don't want to deal with them," I said. "I'm sorry it didn't work out, Tsutomu," she said quietly. We soaked for a while, both of us lost in thought. Finally I changed the subject. "I want to tell you something I've been thinking about," I said. "I've thought about a lot of things while you were away. I'd really like to try having a committed relationship with you, if you're willing to." Julia smiled. She didn't say anything, but she reached over and held me closely. It seemed like we would now be able to share a lot of time together. I told her I'd taken a leave of absence from the universlty and now I was looking forward to skiing and getting away. I was finally pursuing my long-held plan to spend a winter in the mountains, spending the mornings and late afternoons skiing and the mid-days and evenings thinking and working on my research projects. "Why don't you come with me and live in the mountains?" I suggested. "You can come ski and it will be good to be outside." We woke at about 1 P.M. the next day and Julia -- who grew up on the East Coast and is still learning to deal with mild California winters -- told me that she had seen the first morning light before she fell asleep and thought to herself, *It's Christmas and there is no sign of it here.* She was still jet-lagged and also feeling what she feared was flu coming on. We decided to spend the day inside, catching up on talk and sleep. It was chilly out, so Julia turned up Toad Hall's central heat, still eager to soak up the warmth of civilization after two months in the Himalaya. A bit later, while she rested, I was walking around the house, and several times went past the Sun SPARCstation in the hallway. It was a reminder that I probably had new electronic mail, but I didn't feel like checking it. At just about that moment, however, ominous bits of data were flowing through the Ethernet cable that wound through Toad's rooms and hallways. From somewhere, perhaps thousands of kilometers away, an electronic intruder had taken control of toad.com by remotely commandeering the SPARCstation in the basement. And while the two of us spent the day together two floors above, the electronic hijacker was using toad.com as a staging base to launch an attack on the computers in my own beach house some 800 kilometers south. ----- From: "Takedown: The pursuit and Capture of Kevin Mitnick, America's Most Wanted Outlaw -- By the Man Who Did It," by Tsutomu Shimura, with John Markoff, Hyperion Press, a subsidiary of The Disney Company, 1996, 326 pp. $24.95. ISBN 0-7868-6210-6 [pp. 17-21] ---------- The author appears on NBC's Dateline tomorrow, January 12.

2 1

Re: Net Control is Thought Control
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I had a request for more info on the book "Coercive Persuasion". written by Edgar H. Schein. "a socio-psychological analysis of the 'brainwashing' of American civilian prisoners by the Chinese Communists". c 1961 WW Norton & CO, Inc this book was written in 1961 when the word "brainwashing" had just been invented. the American prisoners came back from China saying that they believed in communism and that they knew they were "spies" when they were not, etc. considers the link between social situation and beliefs and shows that the former has tremendous effect on people's philosophies. the Chinese had pretty much perfected all the techniques of getting people to change their beliefs without necessarily the overt methods of totalitarian systems such as torture, suppression of free speech etc. in fact they tended to create systems in which speech was encouraged, but was subtly manipulated so that it was always used in their favor. again, as I wrote: thought control without the subject realizing it was thought control. this is especially dangerous in cyberspace as I mentioned because one now has all kinds of "virtual communities" that may not behave in the same ways that communities now do (such as widespread use of pseudonymity) and hence have unanticipated effects.

1 0

RE: Zimmermann case is dropped.
by Cedric Tefft 17 Dec '03

17 Dec '03

> From: owner-cypherpunks > To: cypherpunks > Cc: prz > Subject: Zimmermann case is dropped. > Date: Monday, January 08, 1996 3:35AM > > Return-Path: <owner-cypherpunks(a)toad.com> > X-Authentication-Warning: net.indra.com: uumaalox set sender to prz@maalox > using -f > Message-Id: <199601081035.KAA02532@maalox> > Subject: Zimmermann case is dropped. > To: cypherpunks(a)toad.com (Cypherpunks) > Date: Mon, 8 Jan 1996 03:35:46 -0700 (MST) > Cc: prz(a)acm.org (Philip Zimmermann) > From: Philip Zimmermann <prz(a)acm.org> > Reply-To: Philip Zimmermann <prz(a)acm.org> > X-Mailer: ELM [version 2.4 PL22] > Content-Type: text > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > ---------------------------------------------------------------------------- -- > -----BEGIN PGP SIGNED MESSAGE----- > > My lead defense lawyer, Phil Dubois, received a fax this morning from > the Assistant US Attorney in Northern District of California, William > Keane. The letter informed us that I "will not be prosecuted in connection > with the posting to USENET in June 1991 of the encryption program > Pretty Good Privacy. The investigation is closed." > > This brings to a close a criminal investigation that has spanned the > last three years. I'd like to thank all the people who helped us in > this case, especially all the donors to my legal defense fund. Apparently, > the money was well-spent. And I'd like to thank my very capable defense > team: Phil Dubois, Ken Bass, Eben Moglen, Curt Karnow, Tom Nolan, and Bob > Corn-Revere. Most of the time they spent on the case was pro-bono. I'd > also like to thank Joe Burton, counsel for the co-defendant. > > There are many others I can thank, but I don't have the presence of mind > to list them all here at this moment. The medium of email cannot express > how I feel about this turn of events. > > > -Philip Zimmermann > 11 Jan 96 > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBMPDy4WV5hLjHqWbdAQEqYwQAm+o313Cm2ebAsMiPIwmd1WwnkPXEaYe9 > pGR5ja8BKSZQi4TAEQOQwQJaghI8QqZFdcctVYLm569I1/8ah0qyJ+4fOfUiAMda > Sa2nvJR7pnr6EXrUFe1QoSauCASP/QRYcKgB5vaaOOuxyXnQfdK39AqaKy8lPYbw > MfUiYaMREu4= > =9CJW > -----END PGP SIGNATURE----- > Chalk one up for the good guys. Thanks for hanging in there Phil. - Cedric

2 1

Saw the Tsutomu and John show... (Mitnick haters skip this)
by andypr＠ix.netcom.com 17 Dec '03

17 Dec '03

Saw the Stanford seimnar given by Tsutomu Shimomura and John Markoff, on the subject of Tsutomu's pursuit of Kevin Mitnick. While not a technical seminar on the vulnerablities of TCP and system services, the talk was quite interesting and I recommend it to you, if they bring it to a campus or bookstore near you. Markoff began with brief bio of Mitnick, with stories of the legendary 8BBS in the late 70's, and how Mitnick started his "career" as a phone phreak, exploting his understanding of social processes inside companies (whom to spy on or dupe to get confidential information.) Tsutomu played a hilarious and vile sounding taunt left on his answering machine after a breakin (presumably Mitnick, but never stated, perhaps for legal reasons). Markoff's presentation was interesting, but pretty much old hat for people who read his stories or the Mitnick chapter of the Hafner/Markoff text _Cyberpunk_. Markoff did mention that Mitnick was _Anton Chernoff_ on 8BBS, something I do not recall in Markoff's previous writings. Then Tsutsomu described how he got involved in the case, after a friend of his asked for help. He illustrated his tracking of Mitnick with logfiles and realtime-captured vt100 transcripts of Mitnick's breakin attempts and talk sessions with associates. These were quite hilarious, as Mitnick apparently took his breakins very personally, and planned various nasty pranks to play on Tsutsomu and Markoff. (Note to TS, please equip your VT100 playback with bigger fonts or get a magnifier program for your laptop, as is used by the visually impaired, as it was very hard to read the material, especially the obscenities and vulgar personal remarks you did not dignify with reading ;-) I particularly liked the low key and realistic image of Mitnick; neither evil genius nor master technician (TS speculates that Mitnick could not have written his Morris/Bellovin IP ISN spoofer or other tools, but rather had a standard collection of breakins that he mechanically applied to the companies whose data his desired) Mitnick's main skills were his understanding of how tech companies work, and his updating of the phone-phreak "social engineering" techniques, applied to software developers instead of telco people. They also managed to convey how throughly unpleasant and mean-spirited Mitnick is (contrast with the poor oppressed boy picture given by Bloombecker's text). Tsutomu mentioned that much source material for the investigation, including a Java version of the vt100 transcript player with many Mitnick intercepts, will be available from www.takedown.com (which does not appear to be up yet.) The cite is Takedown, Tsutomu Shimomura with John Markoff, Hyperion 1996. ISBN 0-7868-6210-6. Cheers, Andy (andy(a)acgeas.com)

1 0

RE: Net Control is Thought Control
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:41 PM 1/10/96, David Mandl wrote: >P.S.: Regarding limits on "freedom of speech" in the U.S., take a look >at the long list Tim May posted a few months back. (I was scoffing at >Perry's claim that we had nearly complete freedom of speech in the >U.S., and then Tim responded with much more detail.) This may have been more than a "few" months back...maybe even more than several. I'm not sure when I wrote this, and I have too many megs of past messages to find it. The gist (without examples right now) is that the U.S. has a truly stunning amount of regulation of speech. Between regulation of professions, restrictions on product claims, the whole mess of tort law, and the various anti-discrimination and fairness laws, the only speech which is truly free is that of penniless idiots spouting off in public parks. The U.S. has few restrictions on speech in the form of prior restraint (that is, words do not have to be cleared by censors or approval boards, mostly), but a welter of post-speech sanctions. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

https & encrypted connections
by Don M. Kitchen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First of all, let me apologize for not being very knowledgable about CA's and https and SSLeay, apache, and generating renegade (ie, your own) certificates. If someone wants to go over this [again] certainly it'd be welcome. I was today playing around with a Mozilla 2.0beta5 that someone gave me [more bells and whistles than my 1.12, but not much more bang for the buck] and was showing a friend all the nifty information that netscape tells about you when you visit sites, then went to c2 to show off the apache web server and when I tried to use https:// to show off how you can have your own encrypting web server for free and everything, a window popped up and said the certificate was expired. I couldn't really tell if it meant that the certificate that Sameer generated really needed to be updated, or if Netscape beta 5 had just been rigged to reject non-netscape certificates, but the end result was no encryption. (Jeff, if you're reading this, of course we know that Netscape, with it's open loving policies wouldn't do anything underhanded, but the thought does come to mind, and by the way, when are we going to see an option to turn off or control what information is passed out to the other end. Specifically, I'd like http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl to come up nearly blank.) Soooo, anyway, I was wondering if anyone knows anything about the use of privately generated certificates. Yes, Jeff, we know that Netscape is jumping to fully support user-specified certificates, but personally I saw, relating to certificates, a lot of *nifty* options and displays, but really didn't see much in the way of anything that looked like "add". ...Looking forward to the day where end-to-end encryption is king, and the TLA, my competition, or anyone else can take their packet sniffer and kiss my butt. Don PS: my predictions on the PRZ-secretly-sold-out-rumor-index: 6. my predictions on the IQ of those making those claims: 6. (cumulative) woohooo Phil! - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMPXDV8La+QKZS485AQHkXwMAnGWVeLB6ntpkK1ksZ7a8+iklA/sPfIT2 XqqJRRX0Ddg2UuAAxmk6WOC/nxnRPRlM/4AkkaEohZRv14ccnlvv3qVGFxpLlxKG iYgbn1x9/xgHjwAB31HqozQix79wPfB/ =v9ni -----END PGP SIGNATURE-----

2 1